1. Technical Field
The present invention relates generally to data processing systems and in particular to security of data processing systems. Still more particularly, the present invention relates to a method, system, and program product for developing policy documents that provide up-to-date monitoring and security features for data processing systems and networks.
2. Description of the Related Art
The utilization of computer networks by companies and corporations has become the norm for internal communication and sharing of information and assets. Many business today have an internal network that connects the employee terminals to a central server (or server banks). These networks are often connected to an external network, such as the Internet. In certain situations the business network comprises external customer systems as in online retail businesses, etc.
Networks require maintenance, and most networks are maintained by a system administrator, who is responsible for upkeep of the network and security of the network. Security is becoming increasingly important as many businesses maintain valuable company assets on their network. In addition, business offering customer services over their networks are increasingly concerned about the security of the online transactions and services provided. As the need for security increases and more and more companies utilize their networks to carry out day to day business and transmit secure information, the burden of system administration has greatly increased.
Current methods by which a network administrator is able to ensure that a network is utilized properly, while maintaining network security, include utilization of a policy document. The security policy document is a series of statements, or constraints, on network resources that should be respected by the users of the system. The policy document defines the proper use of the network. The document is important because the document helps to define assets within a network and the proper use of these assets. Ideally, the document is written in a language that very closely resembles human readable language, which can be translated into a form usable by the computer.
The initial policy document is created by system administration, who spends a significant amount of time deciding on the various rules to apply to the particular network. Since each network is different, the rules provided for one network may be very different for another network. The policy document is network specific because the document is closely tied to the needs of the business, or entity, that is utilizing the network. Thus, each network requires the creation of an initial policy document, often completely. Notably also, the policy document does not change in response to changes in the network. Rather, the document only changes in response to an individual's idea of how the network services should be utilized and the resources allocated.
Irrespective of these shortcomings, many networks utilize policy documents because the policy documents are crucial for managing business processes and resources. The policy documents define what assets to protect, how and when those assets are to be protected. The policy documents serve as a baseline for performance and quality assessment, as well as means for communicating those criteria to others. In the context of network security, policy documents define what constitutes appropriate utilization of network resources, when those resources should be utilized, and by whom.
While prominent security organizations like SANS insist that a formal information security policy document is fundamental to the security of any network, few organizations have one. The lack of formal security policy documents is primarily because creating a formal security policy document is a daunting and time intensive task and offers no immediate benefit. A typical network has a very large number of operating features that has to be described; yet once these features are captured within the security policy document, the life of the network administrator is still not made easier. Most notably, changes in the network are not captured by the security policy document currently in place, and the security policy document may easily become ineffective when major changes occur in the network.
Thus, despite the introduction of the policy document, there is presently no mechanism available to enable the System Administrators (SAs) to easily generate or update a policy document that would provide up-to-date network usage data and security.